Web Application Exploit Development

• Metasploit Unleashed
• Donate – Help Feed a Child
• Introduction
  • Requirements
  • Metasploit Architecture
    • Filesystem And Libraries
    • Modules and Locations
    • Metasploit Object Model
    • Mixins and Plugins
• Metasploit Fundamentals
  • Msfcli
  • Msfconsole
    • MSFconsole Commands
  • Exploits
    • Using Exploits
  • Payloads
    • Payload Types
    • Generating Payloads
  • Databases
    • Using the Database
  • Meterpreter
    • Meterpreter Basics
    • Python Extension
      • Python Extension Examples
• Information Gathering
  • Port Scanning
  • Hunting for MSSQL
  • Service Identification
  • Password Sniffing
    • Extending Psnuffle
  • SNMP Sweeping
  • Writing Your Own Scanner
  • Windows Patch Enumeration
• Vulnerability Scanning
  • SMB Login Check
  • VNC Authentication
  • WMAP Web Scanner
  • Working with NeXpose
    • NeXpose via MSFconsole
  • Working with Nessus
    • Nessus via MSFconsole
• Writing a Simple Fuzzer
  • Simple TFTP Fuzzer
  • Simple IMAP Fuzzer
• Exploit Development
  • Exploit Development Goals
  • Exploit Format
  • Exploit Mixins
  • Exploit Targets
  • Exploit Payloads
    • MSFvenom
      • MSFpayload
      • MSFencode
    • Alphanumeric Shellcode
    • MSFrop
  • Writing an Exploit
    • Getting a Shell
  • Using the Egghunter Mixin
    • Completing the Exploit
  • Porting Exploits
• Web App Exploit Dev
  • Installing Dot Defender
  • Analyzing the Exploit
  • Skeleton Creation
  • Making a Log Entry
  • Hosting the JavaScript
  • Final Exploit
• Client Side Attacks
  • Binary Payloads
    • Binary Linux Trojan
  • Client Side Exploits
  • VBScript Infection Methods
• MSF Post Exploitation
  • Privilege Escalation
  • PSExec Pass the Hash
  • Event Log Management
  • Fun with Incognito
  • Interacting with the Registry
    • Persistent Netcat Backdoor
  • Enabling Remote Desktop
  • Packet Sniffing
  • Pivoting
    • Portfwd
  • TimeStomp
  • Screen Capture
  • Searching for Content
  • John the Ripper
• Meterpreter Scripting
  • Existing Scripts
  • Writing Meterpreter Scripts
  • Custom Scripting
  • Useful API Calls
  • Useful Functions
• Maintaining Access
  • Keylogging
  • Meterpreter Backdoor
    • Interacting with Metsvc
  • Persistent Backdoors
    • Meterpreter Service
• MSF Extended Usage
  • Mimikatz
  • Backdooring EXE Files
  • Karmetasploit
    • Karmetasploit Configuration
    • Karmetasploit in Action
    • Karmetasploit Attack Analysis
  • MSF vs OS X
  • File-Upload Backdoors
  • File Inclusion Vulnerabilities
  • PHP Meterpreter
  • Building A Module
  • Payloads Through MSSQL
    • Creating Our Auxiliary Module
    • The Guts Behind an Auxiliary Module
  • Web Delivery
• Metasploit GUIs
  • MSF Community Edition
    • MSF Community: Scanning
    • MSF Community: Exploitation
    • MSF Community: Post Exploitation
  • Armitage
    • Armitage Setup
    • Armitage Scanning
    • Armitage Exploitation
    • Armitage Post Exploitation
• Post Module Reference
• Auxiliary Module Reference
  • Admin HTTP Auxiliary Modules
  • Admin MySQL Auxiliary Modules
  • Admin MSSQL Auxiliary Modules
  • Admin Postgres Auxiliary Modules
  • Admin VMware Auxiliary Modules
  • Scanner DCERPC Auxiliary Modules
  • Scanner Discovery Auxiliary Modules
  • Scanner FTP Auxiliary Modules
  • Scanner HTTP Auxiliary Modules
  • Scanner MySQL Auxiliary Modules
  • Scanner MSSQL Auxiliary Modules
  • Scanner IMAP Auxiliary Modules
  • Scanner NetBIOS Auxiliary Modules
  • Scanner POP3 Auxiliary Modules
  • Scanner SMB Auxiliary Modules
  • Scanner SMTP Auxiliary Modules
  • Scanner SNMP Auxiliary Modules
  • Scanner SSH Auxiliary Modules
  • Scanner Telnet Auxiliary Modules
  • Scanner TFTP Auxiliary Modules
  • Scanner VMware Auxiliary Modules
  • Scanner VNC Auxiliary Modules
  • Server Capture Auxiliary Modules
• Recent Changes to Metasploit Unleashed

Web Application Exploit Development | Metasploit Unleashed

This section of Metasploit Unleashed is going to go over the development of web application exploits in the Metasploit Framework. The web application that we will be using is called dotDefender. The code we are going to use for the base of our exploit can be found on the Exploit-DB website: https://www.exploit-db.com/exploits/14310/

‹ PREVIOUS PAGE Porting Exploits

NEXT PAGE › Installing Dot Defender